# CVE-2026-93886: IBM i cross-site scripting in HTTP Server Administration GUI

Source: https://junglewise.ai/threats/cve-2026-93886-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-remote-authenticated  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-93886 · Severity: high · CVSS 8.3 · Published 2026-10-13

IBM i is an enterprise operating system that runs business-critical applications. A vulnerability in the HTTP Server Administration web interface allows authenticated attackers to inject malicious script code that executes in the browsers of other users, potentially leading to credential theft, data exfiltration, or unauthorized administrative actions.

Technologies: [IBM I](https://junglewise.ai/threats/technologies/i). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-93886 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93886 being exploited in the wild.

**How severe is CVE-2026-93886?** High severity, with a CVSS score of 8.3, published 13 October 2026.

**Which products and versions are affected?** IBM i 7.3, 7.4, 7.5, 7.6.

**Is there a fix for CVE-2026-93886?** Yes: fixed in IBM i 7.3 with PTF SJ11641, 7.4 with PTF SJ11643, 7.5 with PTF SJ11644, 7.6 with PTF SJ11645. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-93886 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-93886?** Check whether you run IBM I or IBM i at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in IBM i 7.3 with PTF SJ11641, 7.4 with PTF SJ11643, 7.5 with PTF SJ11644, 7.6 with PTF SJ11645

## Technical details

The vulnerability is a cross-site scripting (XSS) flaw in the IBM i HTTP Server Administration GUI caused by improper input validation (CWE-79). An authenticated remote attacker can inject arbitrary script code through user-supplied input, which executes in the context of other users' sessions when they access the interface. No user interaction is required beyond the attacker being authenticated.

## Affected products

- IBM IBM i 7.3, 7.4, 7.5, 7.6

## Timeline

- 2026-10-13: disclosed

## References

- [https://www.ibm.com/support/pages/node/7291760](https://www.ibm.com/support/pages/node/7291760)

## Related threats

- [IBM i missing authorization in Host-Based Printer Subsystem](https://junglewise.ai/threats/cve-2026-77153-ibm-i-7-6-7-5-7-4-and-7-3-could-allow-a-remote-unauthenticated)
- [IBM i Navigator authentication bypass via improper access control](https://junglewise.ai/threats/cve-2026-93744-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-an-unathenticated-remote)
- [IBM i ChrootDirectory security restriction bypass in OpenSSH](https://junglewise.ai/threats/cve-2026-17491-ibm-i-7-3-7-4-7-5-and-7-6-is-could-allow-a-remote-authenticated)
- [IBM i improper authentication bypass in SST/DST](https://junglewise.ai/threats/cve-2026-17488-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-remote-authenticated)
- [IBM i file handle access control vulnerability in NFS](https://junglewise.ai/threats/cve-2026-17073-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-local-attacker-to-obtain)